Email: 548740 Autolearn: 0 AvgScore: 3.78 AvgScanTime: 1.33 sec Spam: 156779 Autolearn: 0 AvgScore: 13.47 AvgScanTime: 1.46 sec Ham: 391961 Autolearn: 0 AvgScore: -0.09 AvgScanTime: 1.27 sec Time Spent Running SA: 201.99 hours Time Spent Processing Spam: 63.52 hours Time Spent Processing Ham: 138.47 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 149876 89.34 95.60 86.83 2 DKIM_SIGNED 140781 73.42 89.80 66.86 3 XM_DK_Pass 135497 71.42 86.43 65.41 4 XM_B_Unicode 135346 75.77 86.33 71.55 5 DKIM_VALID 134047 70.41 85.50 64.37 6 T_SCC_BODY_TEXT_LINE 127243 82.72 81.16 83.35 7 RELAYCOUNTRY_US 125571 75.19 80.09 73.22 8 XM_B_SpammyWords 114476 49.99 73.02 40.77 9 DCC_CHECK 113619 40.81 72.47 28.14 10 XMListUnsubscribeExists 111597 51.36 71.18 43.43 11 DKIM_VALID_AU 99685 54.43 63.58 50.77 12 XM_DK_Undo_02 72688 17.27 46.36 5.64 13 XM_B_Unicode3 71723 44.50 45.75 43.99 14 XM_B_SpammyWords2 64655 23.94 41.24 17.01 15 BAYES_50 62210 55.90 39.68 62.39 16 LOC_TINY_FONT_1 60565 26.61 38.63 21.80 17 TR_XM_DKIM_Undo 57092 12.38 36.42 2.76 18 HTML_FONT_LOW_CONTRAST 56780 27.18 36.22 23.56 19 BAYES_99 56410 13.49 35.98 4.49 20 MIME_HTML_ONLY 52960 27.83 33.78 25.46 21 FVGT_m_MULTI_ODD 50724 25.41 32.35 22.64 22 DKIM_VALID_EF 50486 27.56 32.20 25.70 23 T_KAM_HTML_FONT_INVALID 46114 21.63 29.41 18.52 24 BAYES_999 45533 10.70 29.04 3.36 25 DCC_CHECK_NEGATIVE 43141 59.16 27.52 71.82 26 TR_DCC_Bayes_99 40952 8.82 26.12 1.90 27 XMSubLong 38094 28.21 24.30 29.77 28 TR_XM_DK_Unsub 37517 15.13 23.93 11.61 29 T_TM2_M_HEADER_IN_MSG 36013 26.84 22.97 28.38 30 RCVD_IN_MSPIKE_H2 32694 19.39 20.85 18.80 31 RELAYCOUNTRY_META 31647 8.45 20.19 3.76 32 XM_Multi_Part_URI 29019 13.86 18.51 12.00 33 XM_B_Unsub 25822 15.88 16.47 15.64 34 TR_XM_SpammyRelay 24764 5.88 15.80 1.91 35 TR_XM_BayesUnsub 24697 14.67 15.75 14.23 36 BOTNET_IPINHOSTNAME 22952 6.56 14.64 3.32 37 UNPARSEABLE_RELAY 22567 10.43 14.39 8.85 38 LOTS_OF_MONEY 22277 8.41 14.21 6.09 39 RCVD_IN_BL_SPAMCOP_NET 22014 4.51 14.04 0.69 40 TR_XM_SpammyWords2 20932 4.47 13.35 0.92 41 XM_B_SpammyWords3 20745 6.50 13.23 3.81 42 TR_XM_SpammyWords4 19823 6.72 12.64 4.36 43 XM_Body_Dirty_Words 19018 7.04 12.13 5.00 44 TR_XM_SPAMCOP 18392 3.55 11.73 0.28 45 RELAYCOUNTRY_CA 17927 3.96 11.43 0.98 46 BOTNET 15696 3.68 10.01 1.15 47 RCVD_IN_MSPIKE_H3 15686 6.97 10.01 5.76 48 RCVD_IN_MSPIKE_WL 15686 6.97 10.01 5.76 49 XM_Evil_Numbers_Gen 15258 7.79 9.73 7.01 50 FSL_BULK_SIG 14300 4.63 9.12 2.84 51 BAYES_80 12807 4.96 8.17 3.67 52 TR_XM_UnparsRelay 11809 3.26 7.53 1.55 53 LotsOfNums_01 11453 7.65 7.31 7.79 54 BAYES_60 11175 7.73 7.13 7.97 55 XMBody_17 10314 2.24 6.58 0.51 56 XMSubMetaSx_00 9943 4.27 6.34 3.44 57 HTML_IMAGE_RATIO_02 9815 4.99 6.26 4.48 58 XM_UncommonTLD01 9210 4.14 5.87 3.44 59 XMSexyCombo_05 9097 2.60 5.80 1.31 60 UNTRUSTED_Relay 8754 2.60 5.58 1.40 61 MPART_ALT_DIFF 8403 4.24 5.36 3.80 62 XM_H_Long_From01 8280 5.11 5.28 5.04 63 HTML_IMAGE_RATIO_04 8163 3.87 5.21 3.34 64 TooManyTo_001 8121 13.23 5.18 16.45 65 T_FILL_THIS_FORM_SHORT 7767 2.02 4.95 0.84 66 XM_B_Phish_Phrases 7711 3.79 4.92 3.34 67 BAYES_95 7430 3.01 4.74 2.32 68 TR_XM_SpammyWords5 7323 2.16 4.67 1.16 69 TR_XM_BayesRelay 7237 1.32 4.62 0.00 70 HTML_IMAGE_RATIO_06 7214 3.79 4.60 3.47 71 DKIM_INVALID 6734 3.01 4.30 2.49 72 XM_B_Investor 6695 2.33 4.27 1.55 73 XMNumbers 6611 2.78 4.22 2.21 74 TR_XM_PhishingBody 6516 2.34 4.16 1.61 75 XM_OfRef6 6386 1.85 4.07 0.96 76 T_XMDrugObfuBody_14 6046 2.33 3.86 1.72 77 XM_SPF_SoftFail 5920 3.24 3.78 3.02 78 HTML_IMAGE_RATIO_08 5902 2.84 3.76 2.47 79 XMStrtUSub 5653 3.96 3.61 4.10 80 MIME_HTML_ONLY_MULTI 5589 2.56 3.56 2.16 81 MIME_QP_LONG_LINE 5571 4.38 3.55 4.71 82 MIME_HTML_MOSTLY 5488 2.40 3.50 1.97 83 T_XMDrugObfuBody_08 5292 1.98 3.38 1.42 84 XM_B_SpammyTLD 5205 2.45 3.32 2.11 85 FONT_INVIS_LONG_LINE 5093 0.96 3.25 0.05 86 XM_URI_RBL 4917 1.02 3.14 0.17 87 TR_XM_FormFill 4880 0.90 3.11 0.01 88 XM_UB50 4854 1.47 3.10 0.82 89 RCVD_IN_VALIDITY_SAFE 4853 3.24 3.10 3.30 90 TM2_M_VERY_LONG_WORD 4722 1.61 3.01 1.05 91 XMDiploma_00 4427 8.12 2.82 10.24 92 SUBJ_ALL_CAPS 4114 1.68 2.62 1.30 93 XM_CamelCaseFrm001 4002 2.15 2.55 1.99 94 TR_LOTS_OF_MONEY3 3996 0.91 2.55 0.26 95 T_TooManySym_01 3981 4.59 2.54 5.41 96 XM_B_Unsub2 3950 1.72 2.52 1.40 97 HTML_MIME_NO_HTML_TAG 3831 2.02 2.44 1.86 98 RCVD_IN_VALIDITY_CERTIFIED 3828 2.72 2.44 2.84 99 HK_RANDOM_REPLYTO 3775 0.75 2.41 0.09 100 TM2_M_URI_OPT_OUT 3746 1.83 2.39 1.60 101 SpammyFromTLD_01 3523 1.20 2.25 0.79 102 FROM_EXCESS_BASE64 3419 1.88 2.18 1.76 103 USER_IN_DEF_DKIM_WL 3354 8.23 2.14 10.66 104 RELAYCOUNTRY_AU 3291 1.08 2.10 0.67 105 XM_H_GMP 3237 3.01 2.06 3.39 106 TR_Mismatch_TLD_02 3223 0.67 2.06 0.12 107 XM_B_SpammyWords4 3215 1.10 2.05 0.72 108 XMStockSpam_06 3212 1.30 2.05 1.00 109 MAILING_LIST_MULTI 3104 2.32 1.98 2.46 110 T_REMOTE_IMAGE 3063 2.88 1.95 3.25 111 XM_DIRTYINTL 2990 0.77 1.91 0.31 112 URI_TRY_3LD 2906 0.88 1.85 0.49 113 URI_HEX 2904 1.16 1.85 0.88 114 T_XMHurry_00 2867 0.88 1.83 0.50 115 HTML_TAG_BALANCE_BODY 2852 0.82 1.82 0.42 116 RCVD_IN_IADB_LISTED 2815 3.73 1.80 4.50 117 XMBdyGiftCard01 2780 0.97 1.77 0.65 118 XM_DK_Undo_01 2769 1.85 1.77 1.88 119 AC_BR_BONANZA 2760 0.59 1.76 0.12 120 TR_XM_PHPDW 2734 0.75 1.74 0.35 121 TR_XM_PHPForged 2732 0.74 1.74 0.34 122 T_XMDrugObfuBody_00 2651 0.89 1.69 0.57 123 BAYES_40 2646 3.69 1.69 4.49 124 TR_XM_FormFill2 2635 0.72 1.68 0.33 125 XM_H_PHPOS 2605 0.70 1.66 0.32 126 TR_XM_NoHeaderRelay 2585 0.57 1.65 0.14 127 T_MONEY_PERCENT 2572 0.57 1.64 0.14 128 TR_LOTS_OF_MONEY2 2572 0.57 1.64 0.14 129 ANY_BOUNCE_MESSAGE 2567 3.27 1.64 3.93 130 BOUNCE_MESSAGE 2566 3.27 1.64 3.93 131 SpammyFromTLD_02 2538 0.74 1.62 0.39 132 XM_HighProb1 2531 0.46 1.61 0.00 133 TR_Symld_Words 2527 1.56 1.61 1.55 134 RCVD_IN_IADB_SPF 2517 3.31 1.61 3.99 135 TR_XM_INV_DKIM 2430 0.48 1.55 0.05 136 XMPhish30 2421 0.81 1.54 0.52 137 RCVD_IN_IADB_DK 2407 2.93 1.54 3.49 138 RCVD_IN_IADB_SENDERID 2393 3.00 1.53 3.58 139 BOTNET_NORDNS 2328 0.43 1.48 0.01 140 XMGenDplmaNmb 2267 1.12 1.45 1.00 141 XM_SendGrid 2224 1.23 1.42 1.15 142 TR_Caps_n_Bayes_99 2183 0.41 1.39 0.02 143 TR_XM_Base64_M1 2107 0.97 1.34 0.81 144 XMSexyCombo_01 2097 0.55 1.34 0.23 145 XMHTML_After_End 2045 0.79 1.30 0.59 146 ALL_TRUSTED 2023 17.48 1.29 23.95 147 BAYES_20 1943 2.59 1.24 3.13 148 RCVD_IN_VALIDITY_RPBL 1908 0.38 1.22 0.04 149 URI_NOVOWEL 1839 1.52 1.17 1.66 150 HTTPS_HTTP_MISMATCH 1838 0.89 1.17 0.78 151 KHOP_HELO_FCRDNS 1722 1.18 1.10 1.21 152 XM_H_PHPMailer 1693 0.83 1.08 0.73 153 XM_B_COVIDMETA 1692 0.49 1.08 0.25 154 XMReplyNow 1578 0.46 1.01 0.23 155 XMPhish14 1567 0.59 1.00 0.42 156 XMSlimDrugH 1554 0.47 0.99 0.27 157 XMSubMetaI_00 1545 0.73 0.99 0.63 158 TR_MetaPhish_Combo_01 1511 0.72 0.96 0.62 159 MPART_ALT_DIFF_COUNT 1457 0.59 0.93 0.46 160 RELAYCOUNTRY_DE 1434 0.48 0.91 0.31 161 XM_B_Phish66 1431 0.45 0.91 0.26 162 XM_ProductURIs 1428 0.88 0.91 0.87 163 XM_H_Long_From02 1427 0.90 0.91 0.90 164 RELAYCOUNTRY_NL 1410 0.34 0.90 0.12 165 XM_H_Undi_Recip 1408 0.40 0.90 0.20 166 DKIM_ADSP_CUSTOM_MED 1391 0.84 0.89 0.82 167 TR_XM_InvalidRelay 1383 0.27 0.88 0.02 168 RDNS_DYNAMIC 1379 0.44 0.88 0.26 169 TR_XM_DK_SendGrid 1376 0.80 0.88 0.77 170 HTML_FONT_FACE_BAD 1352 0.51 0.86 0.37 171 XMSubMetaSxObfu_03 1349 0.45 0.86 0.28 172 XMBody_78 1297 0.50 0.83 0.37 173 DIET_1 1288 0.37 0.82 0.20 174 TM2_M_A_HREF_HREF 1288 0.37 0.82 0.18 175 HTML_FONT_TINY_NORDNS 1284 0.33 0.82 0.13 176 RELAYCOUNTRY_FR 1250 0.40 0.80 0.24 177 XM_B_DNDMA 1237 0.44 0.79 0.30 178 URIBL_BLACK 1235 0.27 0.79 0.06 179 XM_UB99 1232 0.23 0.79 0.00 180 RELAYCOUNTRY_GB 1207 0.58 0.77 0.51 181 TooManyTo_002 1203 1.94 0.77 2.40 182 TVD_RCVD_IP 1200 0.96 0.77 1.04 183 PDS_OTHER_BAD_TLD 1193 0.31 0.76 0.13 184 TM2_M_OBFU_COMMENT 1184 0.34 0.76 0.18 185 XM_B_SEO 1183 0.31 0.75 0.13 186 RCVD_IN_PSBL 1177 0.31 0.75 0.14 187 RCVD_IN_IADB_VOUCHED 1176 2.29 0.75 2.91 188 T_TooManySym_02 1170 1.88 0.75 2.34 189 XMClaimOffer 1162 0.32 0.74 0.15 190 XM_B_COPY_HTML 1153 0.61 0.74 0.57 191 TR_Mismatch_TLD_01 1152 0.40 0.73 0.27 192 XMNoVowels 1145 0.86 0.73 0.91 193 FORGED_GMAIL_RCVD 1136 0.54 0.72 0.47 194 BAYES_00 1129 6.69 0.72 9.07 195 XMHTMLBadTable_001 1123 0.38 0.72 0.25 196 XMMoneyMeta_00 1123 0.52 0.72 0.44 197 THIS_AD 1115 0.43 0.71 0.31 198 FROM_SUSPICIOUS_NTLD 1100 0.21 0.70 0.02 199 XMBody_29 1091 0.24 0.70 0.06 200 XMBrknScrpt_02 1074 0.48 0.69 0.40 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 340358 89.34 95.60 86.83 2 T_SCC_BODY_TEXT_LINE 326680 82.72 81.16 83.35 3 RELAYCOUNTRY_US 287010 75.19 80.09 73.22 4 DCC_CHECK_NEGATIVE 281490 59.16 27.52 71.82 5 XM_B_Unicode 280447 75.77 86.33 71.55 6 DKIM_SIGNED 262079 73.42 89.80 66.86 7 XM_DK_Pass 256399 71.42 86.43 65.41 8 DKIM_VALID 252319 70.41 85.50 64.37 9 BAYES_50 244536 55.90 39.68 62.39 10 DKIM_VALID_AU 199014 54.43 63.58 50.77 11 XM_B_Unicode3 172440 44.50 45.75 43.99 12 XMListUnsubscribeExists 170211 51.36 71.18 43.43 13 XM_B_SpammyWords 159820 49.99 73.02 40.77 14 XMSubLong 116690 28.21 24.30 29.77 15 T_TM2_M_HEADER_IN_MSG 111256 26.84 22.97 28.38 16 DCC_CHECK 110301 40.81 72.47 28.14 17 DKIM_VALID_EF 100737 27.56 32.20 25.70 18 MIME_HTML_ONLY 99776 27.83 33.78 25.46 19 ALL_TRUSTED 93890 17.48 1.29 23.95 20 HTML_FONT_LOW_CONTRAST 92343 27.18 36.22 23.56 21 FVGT_m_MULTI_ODD 88726 25.41 32.35 22.64 22 LOC_TINY_FONT_1 85450 26.61 38.63 21.80 23 RCVD_IN_MSPIKE_H2 73688 19.39 20.85 18.80 24 T_KAM_HTML_FONT_INVALID 72581 21.63 29.41 18.52 25 XM_B_SpammyWords2 66692 23.94 41.24 17.01 26 TooManyTo_001 64494 13.23 5.18 16.45 27 XM_B_Unsub 61300 15.88 16.47 15.64 28 TR_XM_BayesUnsub 55792 14.67 15.75 14.23 29 XM_Multi_Part_URI 47019 13.86 18.51 12.00 30 TR_XM_DK_Unsub 45502 15.13 23.93 11.61 31 USER_IN_DEF_DKIM_WL 41791 8.23 2.14 10.66 32 XMDiploma_00 40141 8.12 2.82 10.24 33 BAYES_00 35564 6.69 0.72 9.07 34 UNPARSEABLE_RELAY 34669 10.43 14.39 8.85 35 BAYES_60 31258 7.73 7.13 7.97 36 LotsOfNums_01 30553 7.65 7.31 7.79 37 XM_DKIMWhitelistDomains 27953 5.17 0.26 7.13 38 XM_Evil_Numbers_Gen 27487 7.79 9.73 7.01 39 IN_ZIMBRA_NJ_WHITELIST 24564 4.50 0.09 6.27 40 LOTS_OF_MONEY 23858 8.41 14.21 6.09 41 TR_XM_DK_Bayes 23357 4.40 0.51 5.96 42 TR_XM_DK_Bayes1 22909 4.32 0.51 5.84 43 RCVD_IN_MSPIKE_WL 22583 6.97 10.01 5.76 44 RCVD_IN_MSPIKE_H3 22583 6.97 10.01 5.76 45 XM_DK_Undo_02 22093 17.27 46.36 5.64 46 T_TooManySym_01 21214 4.59 2.54 5.41 47 TR_XM_DK_Bayes2 19950 3.75 0.40 5.09 48 XM_H_Long_From01 19774 5.11 5.28 5.04 49 XM_Body_Dirty_Words 19608 7.04 12.13 5.00 50 MIME_QP_LONG_LINE 18471 4.38 3.55 4.71 51 RCVD_IN_IADB_LISTED 17642 3.73 1.80 4.50 52 BAYES_99 17612 13.49 35.98 4.49 53 BAYES_40 17606 3.69 1.69 4.49 54 HTML_IMAGE_RATIO_02 17569 4.99 6.26 4.48 55 XM_PDF 17298 3.31 0.55 4.41 56 TR_XM_SpammyWords4 17070 6.72 12.64 4.36 57 XMStrtUSub 16065 3.96 3.61 4.10 58 RCVD_IN_IADB_SPF 15624 3.31 1.61 3.99 59 ANY_BOUNCE_MESSAGE 15393 3.27 1.64 3.93 60 BOUNCE_MESSAGE 15392 3.27 1.64 3.93 61 XM_B_SpammyWords3 14916 6.50 13.23 3.81 62 MPART_ALT_DIFF 14887 4.24 5.36 3.80 63 RELAYCOUNTRY_META 14727 8.45 20.19 3.76 64 BAYES_80 14394 4.96 8.17 3.67 65 RCVD_IN_IADB_SENDERID 14048 3.00 1.53 3.58 66 RCVD_IN_IADB_DK 13661 2.93 1.54 3.49 67 HTML_IMAGE_RATIO_06 13582 3.79 4.60 3.47 68 XM_UncommonTLD01 13501 4.14 5.87 3.44 69 XMSubMetaSx_00 13486 4.27 6.34 3.44 70 XM_H_GMP 13276 3.01 2.06 3.39 71 BAYES_999 13174 10.70 29.04 3.36 72 XM_B_Phish_Phrases 13101 3.79 4.92 3.34 73 HTML_IMAGE_RATIO_04 13088 3.87 5.21 3.34 74 BOTNET_IPINHOSTNAME 13020 6.56 14.64 3.32 75 RCVD_IN_VALIDITY_SAFE 12922 3.24 3.10 3.30 76 T_REMOTE_IMAGE 12723 2.88 1.95 3.25 77 BAYES_20 12269 2.59 1.24 3.13 78 XM_SPF_SoftFail 11844 3.24 3.78 3.02 79 RCVD_IN_IADB_VOUCHED 11388 2.29 0.75 2.91 80 FSL_BULK_SIG 11130 4.63 9.12 2.84 81 RCVD_IN_VALIDITY_CERTIFIED 11116 2.72 2.44 2.84 82 TR_XM_DKIM_Undo 10829 12.38 36.42 2.76 83 DKIM_INVALID 9760 3.01 4.30 2.49 84 HTML_IMAGE_RATIO_08 9666 2.84 3.76 2.47 85 MAILING_LIST_MULTI 9647 2.32 1.98 2.46 86 BAYES_05 9615 1.94 0.66 2.45 87 TooManyTo_002 9420 1.94 0.77 2.40 88 T_TooManySym_02 9167 1.88 0.75 2.34 89 BAYES_95 9107 3.01 4.74 2.32 90 XMNumbers 8668 2.78 4.22 2.21 91 MIME_HTML_ONLY_MULTI 8467 2.56 3.56 2.16 92 SCC_BODY_URI_ONLY 8403 1.72 0.65 2.14 93 XM_B_SpammyTLD 8251 2.45 3.32 2.11 94 XM_CamelCaseFrm001 7807 2.15 2.55 1.99 95 MIME_HTML_MOSTLY 7704 2.40 3.50 1.97 96 RCVD_IN_IADB_OPTIN 7693 1.54 0.48 1.96 97 TR_XM_SpammyRelay 7501 5.88 15.80 1.91 98 TR_DCC_Bayes_99 7453 8.82 26.12 1.90 99 XM_DK_Undo_01 7360 1.85 1.77 1.88 100 HTML_MIME_NO_HTML_TAG 7276 2.02 2.44 1.86 101 HELO_NODOT 7252 1.50 0.64 1.85 102 HELO_NO_DOMAIN 7240 1.50 0.64 1.85 103 INVALID_MSGID 7150 1.35 0.15 1.82 104 FROM_EXCESS_BASE64 6905 1.88 2.18 1.76 105 T_XMDrugObfuBody_14 6761 2.33 3.86 1.72 106 URI_NOVOWEL 6499 1.52 1.17 1.66 107 TR_XM_PhishingBody 6304 2.34 4.16 1.61 108 TM2_M_URI_OPT_OUT 6279 1.83 2.39 1.60 109 TO_MALFORMED 6157 1.12 0.01 1.57 110 TR_XM_UnparsRelay 6085 3.26 7.53 1.55 111 XM_B_Investor 6081 2.33 4.27 1.55 112 TR_Symld_Words 6056 1.56 1.61 1.55 113 T_XMDrugObfuBody_08 5577 1.98 3.38 1.42 114 TooManyTo_003 5538 1.20 0.66 1.41 115 IN_HORDE_ADDRESS_BOOK 5513 1.03 0.07 1.41 116 UNTRUSTED_Relay 5493 2.60 5.58 1.40 117 XM_B_Unsub2 5470 1.72 2.52 1.40 118 XMGappySubj_01 5223 1.00 0.18 1.33 119 XMSexyCombo_05 5144 2.60 5.80 1.31 120 SUBJ_ALL_CAPS 5083 1.68 2.62 1.30 121 XM_H_Trusted_IP 5074 0.92 0.00 1.29 122 KHOP_HELO_FCRDNS 4734 1.18 1.10 1.21 123 XMCapTrack 4601 0.96 0.41 1.17 124 XM_GoogleGroups 4541 0.97 0.50 1.16 125 TR_XM_SpammyWords5 4529 2.16 4.67 1.16 126 XM_SendGrid 4524 1.23 1.42 1.15 127 BOTNET 4495 3.68 10.01 1.15 128 XMBody_95 4331 0.85 0.21 1.10 129 TM2_M_VERY_LONG_WORD 4110 1.61 3.01 1.05 130 TVD_RCVD_IP 4059 0.96 0.77 1.04 131 TooManyTo_004 4036 0.90 0.59 1.03 132 TVD_SPACE_RATIO 3973 0.77 0.14 1.01 133 XMStockSpam_06 3909 1.30 2.05 1.00 134 XMGenDplmaNmb 3904 1.12 1.45 1.00 135 RELAYCOUNTRY_CA 3830 3.96 11.43 0.98 136 XM_OfRef6 3772 1.85 4.07 0.96 137 TR_XM_SpammyWords2 3608 4.47 13.35 0.92 138 XMNoVowels 3566 0.86 0.73 0.91 139 XM_H_Long_From02 3523 0.90 0.91 0.90 140 URI_HEX 3459 1.16 1.85 0.88 141 XM_ProductURIs 3426 0.88 0.91 0.87 142 XMSubNoVowel 3403 0.73 0.37 0.87 143 T_FILL_THIS_FORM_SHORT 3298 2.02 4.95 0.84 144 TooManyTo_005 3247 0.75 0.54 0.83 145 XMGappySubj_02 3216 0.61 0.07 0.82 146 XM_UB50 3209 1.47 3.10 0.82 147 DKIM_ADSP_CUSTOM_MED 3199 0.84 0.89 0.82 148 TR_XM_Base64_M1 3194 0.97 1.34 0.81 149 T_TooManySym_03 3158 0.64 0.24 0.81 150 SpammyFromTLD_01 3087 1.20 2.25 0.79 151 HTTPS_HTTP_MISMATCH 3070 0.89 1.17 0.78 152 TR_XM_DK_SendGrid 3022 0.80 0.88 0.77 153 T_OBFU_PDF_ATTACH 2874 0.55 0.09 0.73 154 XM_H_PHPMailer 2872 0.83 1.08 0.73 155 XM_B_SpammyWords4 2805 1.10 2.05 0.72 156 XMBSHREFv2 2737 0.63 0.47 0.70 157 RCVD_IN_BL_SPAMCOP_NET 2711 4.51 14.04 0.69 158 RELAYCOUNTRY_AU 2635 1.08 2.10 0.67 159 FROM_GOV_DKIM_AU 2570 0.53 0.21 0.66 160 XM_ShortIntro_01 2558 0.61 0.50 0.65 161 RCVD_IN_RP_SAFE 2542 0.65 0.64 0.65 162 XMBdyGiftCard01 2536 0.97 1.77 0.65 163 XMSubMetaI_00 2475 0.73 0.99 0.63 164 TR_MetaPhish_Combo_01 2428 0.72 0.96 0.62 165 MSGID_NOFQDN1 2391 0.44 0.01 0.61 166 SHORT_HELO_AND_INLINE_IMAGE 2359 0.45 0.07 0.60 167 XMHTML_After_End 2314 0.79 1.30 0.59 168 FILL_THIS_FORM 2226 0.48 0.28 0.57 169 T_XMDrugObfuBody_00 2219 0.89 1.69 0.57 170 XM_B_COPY_HTML 2218 0.61 0.74 0.57 171 NML_ADSP_CUSTOM_MED 2201 0.58 0.63 0.56 172 RCVD_IN_RP_CERTIFIED 2174 0.54 0.50 0.55 173 XMLngstWrd_00 2063 0.56 0.64 0.53 174 XMPhish30 2023 0.81 1.54 0.52 175 RELAYCOUNTRY_GB 1995 0.58 0.77 0.51 176 XMBody_17 1985 2.24 6.58 0.51 177 T_XMHurry_00 1955 0.88 1.83 0.50 178 URI_TRY_3LD 1921 0.88 1.85 0.49 179 FORGED_GMAIL_RCVD 1845 0.54 0.72 0.47 180 RCVD_IN_SORBS_DUL 1813 0.34 0.05 0.46 181 MPART_ALT_DIFF_COUNT 1804 0.59 0.93 0.46 182 HTML_IMAGE_ONLY_28 1765 0.48 0.56 0.45 183 XM_B_FormFill 1760 0.34 0.05 0.45 184 XMMoneyMeta_00 1737 0.52 0.72 0.44 185 USER_IN_WHITELIST 1735 0.32 0.00 0.44 186 USER_IN_WELCOMELIST 1735 0.32 0.00 0.44 187 T_Symld_Words_02 1690 0.46 0.53 0.43 188 XMPhish14 1664 0.59 1.00 0.42 189 XM_S_SpammyWords 1640 0.47 0.60 0.42 190 TR_XM_Spammywords 1640 0.47 0.60 0.42 191 XMDateMe_00 1640 0.43 0.48 0.42 192 HTML_TAG_BALANCE_BODY 1627 0.82 1.82 0.42 193 HTML_IMAGE_ONLY_20 1624 0.40 0.36 0.41 194 TO_NO_BRKTS_HTML_ONLY 1610 0.37 0.26 0.41 195 XMBrknScrpt_02 1581 0.48 0.69 0.40 196 HTML_IMAGE_ONLY_32 1570 0.33 0.16 0.40 197 MISSING_HEADERS 1568 0.40 0.39 0.40 198 TM2_M_BODY_EMPTY 1538 0.32 0.14 0.39 199 SpammyFromTLD_02 1534 0.74 1.62 0.39 200 XMBody_78 1451 0.50 0.83 0.37 ----------------------------------------------------------------------